Control Selection 4 Flashcards

A security engineer is reviewing the control baseline for a new cloud-hosted financial system. The system processes highly sensitive PII and is categorized as HIGH impact. Which NIST SP 800-53 baseline should serve as the STARTING POINT for control selection?

Answer: HIGH baseline, tailored further based on system-specific risk factors

NIST RMF guidance specifies that the initial control baseline is selected based on the system's impact level. A HIGH-impact system starts with the HIGH baseline from NIST SP 800-53B. Organizations then tailor that baseline — adding, removing, or modifying controls — based on specific risk factors, but always starting from the appropriate impact-level baseline.

During Step 3 (Select) of the NIST RMF, an organization identifies that several HIGH-baseline controls are not applicable because the system has no external network connectivity. What tailoring action is appropriate?

Answer: Scoping the controls out as not applicable based on the system's operational environment

Scoping is a tailoring action that allows organizations to exclude controls that are not applicable given the system's environment, technology, or operational constraints. When a system lacks external network connectivity, network-related controls may be legitimately scoped out. This is distinct from compensating controls, which substitute an equivalent control when the original cannot be implemented.

An organization cannot implement a required cryptographic control due to a legacy system limitation. The system owner proposes an alternative measure — increased physical security and strict access controls — to reduce equivalent risk. What is this called?

Answer: Compensating control

A compensating control is an alternative security measure put in place when a required control cannot be implemented due to technical, operational, or other constraints. The compensating control must provide equivalent or comparable protection. In this case, enhanced physical security and strict access controls are used to compensate for the inability to implement cryptographic controls on a legacy system.

Which document formally captures the selected controls, tailoring decisions, and planned implementation details for an information system during the NIST RMF Select step?

Answer: System Security Plan (SSP)

The System Security Plan (SSP) is the primary document produced and updated during Step 3 (Select) of the RMF. It documents the system boundary, control baseline, tailoring decisions, control implementation descriptions, and responsibilities. The POA&M tracks remediation of weaknesses; the SAR documents assessment findings; the ATO is the authorization decision itself.

A CGRC practitioner is advising on control selection for a system shared by multiple programs within an agency. Several of the required controls are already implemented at the organizational level and maintained by a central team. How should these be treated?

Answer: Inherited as common controls, referencing the providing system's SSP

Common controls are controls that are implemented at an organizational, site, or program level and inherited by multiple systems. When a system can inherit a control from a common control provider, it should document this inheritance in its SSP, referencing the authoritative source. This avoids duplication of effort and leverages centrally managed security capabilities. Common controls must be documented and authorized, not simply assumed.

When performing control tailoring, an organization adds additional controls beyond the baseline to address a specific, identified threat related to insider privilege abuse. What is this tailoring action called?

Answer: Control supplementation

Control supplementation involves adding controls or control enhancements to a baseline to address specific threats, vulnerabilities, or risks that are not adequately covered by the baseline alone. In this case, insider threat concerns drive the addition of controls beyond what the standard HIGH baseline provides. Scoping removes non-applicable controls; parameterization assigns specific values to control parameters; baseline substitution is not a recognized NIST tailoring action.